(19) 



J 



Europaisches Patentamt 
European Patent Office 
Office europeen des brevets 



(12) 



(43) Date of publication: 

04.07.2001 Bulletin 2001/27 

(21) Application number: 00121783.5 

(22) Date of filing; 05.10.2000 



(11) EP 1 113 617 A2 

EUROPEAN PATENT APPLICATION 

(51) Intel/: H04L9/30 



(84) Designated Contracting States: 


(72) 


Inventor: Wang, Xin 


AT BE CH CY DE DK ES Fl FR GB GR IE ITU LU 




Los Angeles, CA 90007 (US) 


MC NL PT SE 






Designated Extension States: 


(74) 


Representative: GrOneclcer, Kinkeldey, 


AL LT LV MK RO SI 




Stockmair & Schwanh^usser Anwaltssozletat 






Maximllianstrasse 58 


(30) Priority: 21.12.1999 US 468703 




80538 IMOnchen (DE) 


(71) Applicant: ContentGuard Holdings, Inc. 






Wilmington, Delaware 19803 (US) 







(54) System and method for transferring the right to decode messages 



(57) Methods for transferring among key holders in 
encoding and cryptographic systems the right to decode 
and decrypt messages in a way that does not explicitly 
reveal decoding and decrypting keys used and the orig- 



inal messages. Such methods are more secure and 
more efficient than typical re-encoding and re-encryp- 
tion schemes, and are useful in developing such appli- 
cations as document distribution and long-temn file pro- 
tection. 
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Description 

FIELD OF THE INVENTION 

s [0001 1 The Invention relates to cryptographic methods, and more particularly to systems and methods for delegating 
decryption rights without revealing private keys or message contents. 

BACKGROUND OF THE INVENTION 

10 [0002] One of the most important issues impeding the widespread distribution of digital documents via electronic 
commerce is the current lack of protection of the intellectual property rights of content owners during the distribution 
and use of those digital documents. Efforts to resolve this problem have been temned "Intellectual Property Rights 
Management ("IPRM"), "Digital Property Rights Management" ("DPRM"), "Intellectual Property Management" ("IPM"), 
"Rights Management" ("RM"), and "Electronic Copyright Management" ("ECM"). 

IS [0003] A document, as the temi is used herein, is any unit of information subject to distribution or transfer, including 
but not limited to correspondence, books, magazines, joumals, newspapers, other papers, software, photographs and 
other images, audio and video clips, and other multimedia presentations. A document may be embodied in printed 
form on paper, as digital data on a storage medium, or in any other known manner on a variety of media. 
[0004] In the worid of printed documents, a wori< created by an author is usually provided to a publisher, which 

20 formats and prints numerous copies of the work. The copies are then sent by a distributor to bookstores or other retail 
outlets, from which the copies are purchased by end users. 

[0005] White the low quality of copying and the high cost of distributing printed material have served as deterrents 
to the illegally copying of most printed documents, It is far too easy to copy, modify, and redistribute unprotected elec- 
tronic documents. Accordingly, some method of protecting electronic documents is necessary to malce it harder to 
2S illegally copy them. This will serve as a detenrent to copying, even if it is still possible, for example, to make hardcopies 
of printed documents and duplicate them the old-fashioned way. 

[0006] With printed documents, there is an additional step of digitizing the document before it can be redistributed 
electronically; this serves as a deterrent. Unfortunately, it has been widely recognized that there is no viable way to 
prevent people from making unauthorized distributions of electronic documents within current general-purpose com- 
30 puting and communications systems such as personal computers, workstations, and other devices connected over 
local area networks (LANs), intranets, and the Internet. Many attempts to provide hardware-based solutions to prevent 
unauthorized copying have proven to be unsuccessful. 

[0007] Two basic schemes have been employed to attempt to soh^e the document protection problem: secure con- 
tainers and trusted systenns. 

35 [0008] A "secure container" (or simply an encrypted document) offers a way to keep document contents encrypted 
until a set of authorization conditions are met and some copyright terms are honored (e.g., payment for use). After the 
various conditions and terms are verified with the document provider, the document Is released to the user in clear 
torn). Commercial products such as IBM's Cryptolopes and InterTrust's Digiboxes fall into this category. Clearly, the 
secure container approach provides a solution to protecting the document during delivery over insecure channels, but 

40 does not provide any mechanism to prevent legitimate users from obtaining the clear document and then using and 
redistributing it in violation of content owners' intellectual property. 

[0009] Cryptographic mechanisms are typically used to encrypt (or "encipher") documents that are then distributed 
and stored publicly, and ultimately privately deciphered by authorized users. This provides a basic form of protection 
during document delivery from a document distributor to an intended user over a public network, as well as during 

45 document storage on an insecure medium. 

[0010] In the "trusted system" approach, the entire system Is responsible for preventing unauthorized use and dis- 
tribution of the document. Building a trusted system usually entails introducing new hardware such as a secure proc- 
essor, secure storage and secure rendering devices. This also requires that all software applications that run on trusted 
systems be certified to be trusted. While building tamper-proof trusted systems is still a real challenge to existing 

50 technologies, current market trends suggest that open and untrusted systems such as PC's and workstations will be 
the dominant systems used to access copyrighted documents. In this sense, existing computing environments such 
as PC s and workstations equipped with popular operating systems (e.g., Windows and UNIX) and render applications 
(e.g., Microsoft Word) are not trusted systems and cannot be made trusted without significantly altering their architec- 
tures. 

55 [0011] Accordingly, although certain trusted components can be deployed, one must continue to rely upon various 
unknown and untrusted elements and systems. On such systems, even if they are expected to be secure, unanticipated 
bugs and weaknesses are frequently found and exploited. 

[0012] One parttoutar issue arises in the context of document distribution, as described generally above. In the tra- 
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ditional model of document distribution, the content author and the publisher typically do not handle distribution; a 
separate party with distribution expertise is given that responsibility. Furthermore, while it is possible to encrypt a 
document (using standard techniques) so that multiple recipients can decrypt It, it is not usually known at the time a 
work is created who the ultimate users wilt be. It makes more sense for the distributor to determine who the end users 
5 will be, and to distribute the document to them as desired. If, as In traditional model, the original work of authorship is 
sent to a publisher and a distributor in the clear, that is a point of vulnerability for the work. 

[0013] A similar problem arises in office settings, for example, in which it Is frequently desirable to designate what 
is variously called a document agent, surrogate, or delegate. In this situation, it is often useful to be able to give an 
administrative assistant or secretary the right to decrypt certain document not intended directly for that person. 

10 [001 4] Considering the problem more broadly, in a networked environment, messages are often passed to recipients 
other than their initially intended ones. When message confidentiality Is a concem and encrypted messages are for- 
warded, it Is very desirable to allow one to decrypt these messages on behalf of another. To be concrete, suppose that 
Bob is the one who needs to read some message that is initially encrypted for Alice. One trivia! solution is that Alice 
simply reveals her decryption key to Bob so that Bob can use it to decrypt the message himself. This requires Alice to 

15 trust Bob totally, which may not be acceptable to Alice. Another way to accomplish this task is to let Alice first decrypt 
the message, then re-encrypt it for Bob and finally send the newly encrypted message to Bob so that he can decrypt. 
Though the message is communicated securely, this solution is less efficient as it requires two decryption and one 
encryption operations in order for Bob to obtain the message. More importantly, in some situations such re-encryption 
solution is not even applicable or desirable. For example, Alice may not have access to the encrypted message, as it 

20 may be sent by its originator directly to Bob for communk^ation effk^iency and other considerations. Also, decrypting 
the encrypted message to a clear version, even if only for a short time, can be a substantial vulnerability. 
[0015] Accordingly, it would be desirable to have an encryption/decryption framework that supports the ability to 
transfer the right to decode messages. Such a framework would allow a delegate to, essentially, authorize the re- 
encryption of a message for another party's use without first decrypting the original message, it would also be useful 

25 for this to be possible without the delegate ever having possession of the encrypted message. 

SUMMARY OF THE INVENTION 

[001 6] How to transfer the right to decrypt from one key holder to another in a secure and efficient way is the subject 
30 of proxy encryption. Some specific proxy encryption schemes have been recently proposed to convert messages en- 
crypted for one key into messages encrypted for another without revealing secret decryption keys and original mes- 
sages to the public. Mambo and Okamoto have introduced several private, non-commutative, message-independent 
proxy encryption schemes. Blaze and Strauss have introduced a public, commutative, message-independent proxy 
encryption scheme. 

3S [0017] In this disclosure, the same general problem Is Initially addressed but in the more general context of encoding 
schemes. Encoding schemes considered in this disclosure differ from encryption schemes or cryptosystems in that 
they do not necessarily have any security-related requirements. For an encoding scheme to be an encryption scheme, 
it Is necessary that an eavesdropper, upon seeing an encoded message, should be unable to determine either the 
original message or the key used to decode the message. Working with encoding schemes makes it possible to build 

40 applications with lightweight security but high implementation efficiency, such as efficient massive document distribution 
and updating of ciphertext with new keys to protect long-term encrypted messages. In this disclosure, a class of en- 
coding schemes is defined, and several example schemes are given. A process by whbh new schemes can be con- 
structed using existing ones is also offered herein. 

[001 8] Several more formal proxy encryption schemes are then presented. A proxy encryption scheme is an encryp- 
ts tion scheme that allows a designated key holder to decrypt messages on behalf of another key holder. This disclosure 
Introduces two new proxy encryption schemes based on the known EIGama! scheme, with improved functionalities 
over existing proxy encryption schemes. They are public in the sense that proxy-related information and transfomiations 
can be safely made to the public, and at the same time non-commutative in terms of trust relationships among involved 
key holders. Applications of these new schemes to massive document distribution and file protection are also presented. 
50 [0019] The basic idea in the methods present In this disclosure Is as follows: In order for Alice to transfer the right 
to decode to Bob, Alice generates a transfer key t for Bob. With the transfer key t, Bob can re-encrypt the message 
initially encoded for Alice and subsequently decrypt it using his own key. Much like in proxy encryption, the transfer is 
performed in such a way that the transfer key does not explicitly reveal the decoding keys of either Alice or Bob, or the 
origipal message. 

55 [0026] How to delegate the right to decrypt from one key holder to another in secure and efficient ways is the subject 
of proxy encryption. Very recently, some specific proxy encryption schemes have been proposed to convert messages 
encrypted for one key into messages encrypted for another without revealing secret decryption keys and original mes- 
sages to the public. Mambo and Okamoto have described three proxy encryption schemes for the EIGamal and RSA 
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encryption schemes. M. Mannbo and E. Okamoto, "Proxy cryptosystems: Delegation of thepowerto decrypt ciphertexts, 
" tEiCE Trans, on Fundamentals, Vol. E80-A, No. 1 , pp. 54-63 (1997). For the situation mentioned above, their schemes 
have better computational performance over the re-encryption scheme, but for security reasons require the presence 
of the original key holder Alice in the message conversion. Moreover, the schemes themselves do not help specifying 

5 who is the key holder that Alice wants to delegate the decryption right to. The scheme proposed by Blaze and Strauss, 
on the other hand, does not have these shortcomings. It is a modification of the EIGamal encryption scheme. M. Blaze 
and M. Strauss, "Proxy Cryptography," Draft, AT&T Research Labs, ftp://ftp.research.att.com/dist/mab/proxy.ps (May 
1997). One very appearing feature of the Blaze and Strauss scheme is that it pemriits communicating proxy related 
information and performing the message conversion in public. But It introduces a more serious problem: it is commu- 

10 tative in the sense that Bob Is able to obtain Alice's decryption key. This type of commutatlvity makes the proxy en- 
cryption scheme obsolete, as the entire scheme can be well simplified to giving Alice's key to Bob and letting Bob 
decrypt. Another issue (not necessarily a problem) created by this scheme Is that once Bob has been granted the 
decryption right by Alice, he can decrypt all messages that are originally for Alice. This message-independence may 
be useful in some cases such as self-delegation but is not be desirable in many practical applications where the original 

IS key holder wants to be selective on which messages the delegated decryption is allowed. 

[0021] Accordingly, the proxy encryption schemes according to the present invention, which are publte and non- 
commutative, eliminate some of the disadvantages of other known cryptosystems. 

[0022] In this disclosure, two new proxy encryption schemes are then introduced. They are all based on the EIGamal 
public-key encryption scheme and have comparable computational performance. Essentially, they have retained the 
20 following desirable features of the existing schemes: (I) public: the presence of the original key holder is not required 
after proxy information is generated, and proxy related infomnation and operations can communicated and conducted 
in publk;; (il) non-commutative: key holders do not have to trust each other in regard to their private decryption keys; 
and (ill) restricted: the key holder to whom the decryption right is delegated to is specified, and the proxy information 
(key) is message dependent. 

25 [0023] Finally, delegating the right to decrypt messages is then described in the context of the Cramer-Shoup cryp- 
tosystem, whteh bears some advantages over other systems. 

[0024] In a further embodiment the method comprises the step of providing the transformed message to the recipient. 
[0025] In a further embodiment the method comprises the step of decrypting the transfomned message using Infor- 
mation selected from the private key con'esponding to the recipient and any available public infomiation. 
30 [0026] In a further embodiment the method comprises the step of decrypting the transformed message using the 
private key con^espondlng to the recipient. 

[0027] In a further embodiment the encrypted message comprises a first portion and a second portion, the first portion 
encoding a generator and a random key. and the second portion encoding the original message, the public key corre- 
sponding to the grantor, and the random key. 
35 [0028] In a further embodiment the applying step operates on the second portion of the encrypted message. 

[0029] In a further embodiment the encrypted message comprises a first portion and a second portion, the first portion 
encoding the original message, a generator, and a random key, and the second portion encoding the public key cor- 
responding to the grantor and the random key. 

[0030] In a further embodiment the applying step operates on the second portion of the encrypted message. 
40 [0031 ] In a further embodiment the encrypted message comprises a first portion and a second portion, the first portion 
encoding the original message, a generator, and a random key, and the second portion encoding the public key cor- 
responding to the grantor and the random key. 

[0032] In a further embodiment the applying step operates on the second portion of the encrypted message. 
[0033] In a further embodiment the original message is passed to a recipient through at least one additional inter- 
45 mediate grantor by repeating the generating and applying steps for each additional intermediate grantor. 

[0034] These and other features and advantages of the present invention are apparent from the Figures as fully 
described in the Detailed Description of the Invention. 

BRIEF DESCRIPTION OF THE DRAWINGS 

50 

[0035] 

FIGURE 1 is a block diagram of an electronic document distribution system capable of operation according to the 
invention; 

55 FIGURE 2 is a block diagram Illustrating the encoding operations periormed when delegating the authority to 

decrypt a message In a method according to the Invention; 

FIGU RE 3 is a flow chart illustrating the general steps performed in transforming an encoded message for decoding 
by another; 
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FIGURE 4 is a block diagram schematically illustrating the parties involved in a system adapted for the delegation 
of the authority to decrypt messages; 

FIGURE 5 is a flow chart illustrating the steps performed in a generic proxy encryption scheme; 
FIGURE 6 is a flow chart illustrating the steps perfomned in encrypting and decrypting a message according to the 
5 EIGamal cryptosystem; 

FIGURE 7 is a flow chart illustrating the steps performed in a known EIGamal-based proxy encryption and decryp- 
tion scheme proposed by Mambo and Okamoto; 

FIGURE 8 is a flow chart illustrating the steps performed in a known ElGamal-based proxy encryption and decryp- 
tion scheme proposed by Blaze and Strauss; 
10 FIGURE 9 is a flow chart illustrating the steps perfomned in a first embodiment of an ElGamal-based proxy en- 

cryption and decryption scheme according to the invention; 

FIGURE 10 is a flow chart illustrating the steps performed in a second embodiment of an ElGamal-based proxy 
encryption and decryption scheme according to the invention; 

FIGURE 11 is a flow chart Illustrating the steps performed in a document distribution scheme according to the 
15 invention; 

FIGURE 12 is a flow chart illustrating the steps performed in a file protection scheme according to the invention; 
FIGURE 13 is a flow chart illustrating the steps perfomned in encrypting and decrypting a message according to 
the Cramer-Shoup cryptosystem; and 

FIGURE 14 is a flow chart illustrating the steps perfomned in an embodiment of a Cramer-Shoup-based proxy 
20 encryption arid decryption scheme according to the invention. 

The Rgures are more fully explained in the following Detailed Description of the Invention. 

DETAILED DESCRIPTION OF THE INVENTION 

25 [0036] Figure 1 represents a top-level functional model for a system for the electronic distribution of documents, 
which as defined above, may include correspondence, books, magazines, journals, newspapers, other papers, soft- 
ware, audio and video clips, and other multimedia presentations. 

[0037] An author {or publisher) 110 creates a document's original content 112 and passes it to a distributor 114 for 
distribution. Although it Is contemplated that the author may also distribute documents directly, without involving another 
30 party as a publisher, the division of labor set forth in Figure 1 is more efficient, as it allows the author/publisher 1 1 0 to 
concentrate on content creation, and not the mechanical and mundane functions taken over by the distributor 114. 
Moreover, such a breakdown would allow the distributor 1 14 to realize economies of scale by associating with a number 
of authors and publishers (including the illustrated author/publisher 110). 

[0038] The distributor 1 1 4 then passes modified content 1 1 6 to a user 11 8. In a typical electronic distribution model, 
35 the modified content 116 represents an reencrypted version of the original encrypted content 112; the distributor 114 
first decrypts the original content 112 and then re-encrypts it with the user 11B's publk; key; that modified content 116 
is customized solely for the single user 118. The user 118 is then able to use his private key to decrypt the modified 
content 1 1 6 and view the original content 112. 

[0039] A payment 1 20 for the content 1 1 2 is passed from the user 1 1 8 to the distributor 1 1 4 by way of a clearinghouse 

^0 122. The clearinghouse 122 collects requests from the user 118 and from other users who wish to view a particular 
document. The clearinghouse 122 also collects payment infomnation, such as debit transactions, credit card transac- 
tions, or other known eiectronte payment schemes, and forwards the collected users' payments as a payment batch 
124 to the distributor 114. Of course, it is expected that the clearinghouse 122 will retain a share of the user's payment 
120. In turn, the distributor 114 retains a portion of the payment batch 124 and forwards a payment 126 (Including 

45 royalties) to the author and publisher 110. In one embodiment of this scheme, the distributor 114 awaits a bundle of 
user requests for a single document before sending anything out. When this is done, a single document with modified 
content 116 can be generated for decryption by all of the requesting users. This technique is well-known in the art. 
[0040] In the meantime, each time the user 118 requests (or uses) a document, an accounting message 128 is sent 
to an audit server 1 30. The audit server 1 30 ensures that each request by the user 1 1 8 matches with a document sent 

50 by the distributor 1 1 4; accounting information 1 31 is received by the audit server 1 30 directly from the distributor 1 1 4. 
Any inconsistencies are transmitted via a report 132 to the clearinghouse 122, which can then adjust the payment 
batches 124 made to the distributor 114. This accounting scheme is present to reduce the possibility of fraud in this 
electronic document distribution model, as well as to handle any time-dependent usage permissions that may result 
in ch^arges that vary, depending on the duration or other extent of use. 

55 [0041] The foregoing model for electronic commerce in documents, shown in Figure 1 , is in common use today. As 
will be shown in detail below, it Is equally applicable to the system and method set forth herein for the distribution of 
self-protecting documents. 
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Proxy Encoding Schemes 

[0042] For simplicity, initially consider encoding schemes of the following type. An encoding system consists of four 
components: (i) a message space X which is a collection of possible messages, (ii) a Icey space K which is a set of 
possible keys, (ill) a computationally efficient encoding transfomfiation E :Kx X-> Xand (iv) a computationally efficient 
decoding transfonnatjon D : K X X ^ X. For each k G K , the encoding transformation : X— > X and decoding 
transfonnatlon D/^ : X-> Xare injection (one-to-one) mappings on X, and they satisfy that, for every message x G X, 



Certainly, such defined encoding schemes can be varied in several ways to cover a wider range of ones. One is to 
differentiate the space of encoded messages from the one of original messages, and another is to consider that l<eys 
used for encoding and decoding are different. In temis of cryptography, the encoding schemes considered below are 
15 essentially private-key (or, more precisely, symmetric), endomorphic cryptosystems. 

[0043] Such defrned encoding schemes have some advantageous properties. Given an encoding scheme (X, K, E, 
D), each encoding transfomiation and its corresponding decoding transfonnatlon are inverse transfomiation of each 
other; that is, for each ^ G K, 



D^=(E^)-^ andE^=(D^) V 



If X is a finite set, each encoding or decoding transformation is just a penmutation on X. 
[0044] Classic, symmetric-key encryption schemes are encoding schemes. Here are some of them. 
25 [0045] XOR Scheme X. In this scheme, the message space X is the set B„ of all n-brt binary strings for some integer 
n > 0, and so is the key space K. The number of possible messages and the number of possible keys are both 2P. For 
each message x and each key k, the encoding is 



y= Ej^(x) = X© Af 

and the decoding of message y is 

X = 0^(y) = k\ 
where e represents the bit-wise XOR (exclusive or) operation. 

[0046] Multiplicative Scheme M. A message in this scheme is an element in X= Z„ = {0, 1 , .... for some integer 
n > 0. A key Is also an element a in Z„ but satisfying gcd(a, n) = 1 , where the "god" function specifies the greatest 
common integer divisor of the two arguments. That Is, the key space /C consists of the elements in the multiplicative 
group Z*= {a G Z^gcd(a,n)=1}. The encoding of a message x with a key a is 

y- E^ (x) = ax(modn) 

and the decoding of a message y with a key a is 

^= Da(y) = a" Vmodn), 

where a^^ Is the multiplicative inverse of a modulo n\ that Is, ff"" is an element In Z„such that aar''(mod n) = ar*'a(mod 
n) = 1 . Note that the condition on a, gcd(a, n) = 1 , is used to guarantee that a has the inverse ar^. It is known that the 
number of such as is equal to the value of the Euler phi-function 
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where 

5 i_l 

is the prime decomposition of n. So the number of keys in the scheme M is 0(n). 

[0047] Shift Scheme S. Messages and keys of the shift scheme are all elements in Z„ = {0. 1 , .... for some 
Integer n>0; that is, X= K= Thus, the number of messages and the number of keys In the shift scheme are all 
10 equal to n. To encode a message x with a key b, one calculates 

y = E^(x) = x+ b (mod n) 

and to decode a message y with b, one computes 

x= Df,{y) = y'b{mod n). 

20 [0048] Substitution Scheme P. This scheme is also defined over X= Z„, However, the key space K= consiste 
of ail pemnutations of elements In Thus, the total number of keys is nl. For each pemriutatlon p G the encoding Is 

y= Ep{x) = p(x), 

25 

while the decoding is 

x=Dp{y) = p'\yl 

30 

where pri is the inverse pemiutation of p. 

[0049] It should be noted that the muttipricath^e and shift schemes are special cases of the 
substitution scheme which include only 0{n) and n of the n\ possible pennutations of n elements, respectively. 
[0050] New encoding schemes can be constructed by combining existing ones. One way Is to form their "product." 
35 Suppose S and S are two encoding schemes with the same message space X. The product of S and S, denoted by 
SxS\ has the same message space X A key of the product scheme has the form {k, Ac*), where k and k'are keys of 
Sand S, respectively. The encoding and decoding transformations of the product scheme are defined as follows: for 
each key (/f. k) G 

and 

That is, the message x is first encoded with Ef^ and the resulting message is then "re-encoded" with E^.. Decoding is 
similar, but it is done in the reverse order. 
50 [0051] It is straightforward to check that the product construction is always associative: (S x S) x S'= S x (S' x 
S"). If an encoding scheme S is taken to form the product 

with itself, one obtains the scheme Sx S, denoted by If the />fold product is taken, 
the resulting scheme, denoted by S", is called an iterated encoding scheme. 
[0052] A simple example to illustrate the definition of product encoding schemes is as follows. 
55 [0053] Affine Scheme A. This scheme is also defined over X = Z„. A key of the affine scheme Is a pair of integers 
(a, b) in Z„ where gcd(a, n) = 1 . The encoding transformation Is 
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y = ^{a,b)M = (ax + i>) (mod n) 

and the decoding transfoimation is 

5 

^= ^(a,b)(y) = a Vy- fc) (mod n) 

where a^"" is the modular inverse of a modulo n. These transfonmatlons of the type ax + i> are usually called affine 
10 transformations, hence the name affine scheme. Note that the scheme A reduces to the multiplicative scheme M when 
b-0 and the shift scheme S when a = 1 . Thus, M and S are special cases of A. On the other hand. A is their product 
/Vf X S. As seen before, a key in the multiplicative scheme M is an element a e Z* ; the corresponding encoding 
transformation is Ea(x) = ax (mod n). A key in the shift scheme is an element b e Z„, and the con-espondlng encoding 
transfonnation Is E^x) = x + b (mod n). Hence, a key In the product scheme M x S has the f omri (a.t) G Z* x Z„, and 
'5 Its encoding is 

F(^^(x) = E^(F^(x)) = ax + d (mod n). 

20 This is precisely the definition of the encoding transformation in the affine scheme. Similarly, the decoding transforma- 
tion in the affine scheme Is the composition of the decoding transformations of the shift and multiplicative schemes. 
[0054] The objective of transfemng the right to decode messages in any given encoding scheme (X, K, E, D) can 
be stated as follows: for any given message x G X and keys k,k* G K, convert in some efficient way the encoded 
message y= Ej^x) using the key /r into the encoded message E^<x) using the key K so that the new message y* 

25 can be decoded con^ectly using the key k\ If this can be achieved, It Is said that the right to decode the message y has 
been transferred or delegated from the key holder of kXo the key holder of k*. 

[0055] Figure 2 Illustrates the transfonnation n 21 0 that Is needed to achieve the objective. The thick lines 21 2, 21 4, 
and 216 representing transfonrnations E^f, n, and D^, respectively, form a sequence of steps that encodes a message 
X with one key k, converts the encoded message into the other one encoded with another key /c*, and decodes the 
30 message using the key k'. The thin lines 21 8 and 220, representing the transfomnations E^ and D^^, respectively, show 
other possible encoding and decoding operations that may be performed. 

[0056] In many cases, the key space K of an encoding scheme is not merely a set. Equipped with some operation 
K may possess some mathematical structure. For instance, the key spaces of all the example schemes given in 
the previous section can be equipped with some operations to become mathematical groups. Table 1 , below, shows 
35 some of these operations, where stands for the composition operator of pemiutations and 

*:(Z;xZ„)x(Z;xZ„)->2;xZ„ 

40 is defined as 

(a,6) * (a\b') = (a'a(mod n),a'd + i>'(mod n)). 

45 

Table 1 



Scheme 


Key Space "K" 


Operation 


X 




e (XOR) 


M 


K 


X (mod n) 


S 




+ (mod n) 


P 




(composition) 


A 




* (defined at>ove) 



[0057] When the key space Kof an encoding scheme (X. K E. D) is a group with some operation the encoding 
and decoding transfonnatlons may be uniquely determined by the keys. This happens when the key space Kis iso- 
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morphic, as a group, to the transformation groups E = \ K) and D = {Dj^ I /f G K} formed by the encoding and 
decoding transfomnations on the message space X; that is, for any k,k' G K, 

^ D, = {E^y' = E^., and f o E,. = E^^, 

and 

^ir = {OS^ = O .1 and Dju o Dfc..= D , 
where is the composition operator of the transfomnations, which is defined as, for example, 
,3 E^oE,ix)=E^iE^x)) 
for all X G X. 

[0058] It can be easily checked that all the schemes given in Table 1 above are key-detemnined. Key-determined 
encoding schemes pemnit a systematic way to transfer the right to decode messages from one key holder to another. 

20 With the isomorphism between the key space and the transfonnation groups, the composition of the decoding trans- 
fomnation with one key k and the encoding transfomiatton with another key k* can then be viewed as the encoding 
transfonnation detemnined by the composed key k^- k. Let (X, K, E, D) be a key-determined encoding scheme. Suppose 
y = E;Xx) is the encoded version of the message x G X with the key k G K . The right to decode the encoded message 
of xcan be transfen-ed from the key holder of /r to the key holder of k in the two-step algorithm shown in Figure 3. 

25 [0059] First, generate a transfer key t= k^ - k (step 31 0). Then encode the message with the transfer key t according 
toy' = E^{step312). 

[0060] The algorithm Is correct than ks to the property of the key space being isomorphk: to the encoding and decoding 
transformation groups. The correctness can be verified as follows: 

DAE Ay)) 

A- (^*. ».(>')) 

D, iEAE,,(y))) 

E, ,(y) 

D,(EAx)) 

X 

[0061] The generality of the algorithm makes it immediate to derive the transference steps for the example schemes 
set forth above. Refemng again to Figure 3, for the XOR Scheme X over to convert y= EfJ^)^ to y = Ej^.(x). first 
generate a transfer key f = /c © AT (step 31 0). Then encode the message with the transfer key t according to y' = y © f 
45 (step 312). 

[0062] For the Multiplicative Scheme M over Z* , to convert y = Ea(x) to y' = Ea<x), first generate a transfer key t = 
a'er^ (mod n) (step 31 0). Then encode the message with the transfer key t according to y'= (y (mod n) (step 312). 
[0063] For the Shift Scheme S over to convert y= E^(x) to y'= E4,(x), first generate a transfer key t^b'-b (mod 
n) (step 31 0). Then encode the message with the transfer key t according to y = y + f (mod n) (step 312). 

50 [0064] For the Substitution Scheme P over n„, to convert y = Ep(x) to y' = Ep{x), first generate a transfer key t= pr^ 
o (step 310). Then encode the message with the transfer key t according to y = /(y) (step 312). 
[0065] As will be described below, it is also possible to transfer the right to decode In product schemes of not only 
key-determined encoding but also commuting schemes. In order to define commuting schemes, it is necessary to 
characterize encoding schemes that are essentially equivalent. Suppose that S= (X, K, E, D) and S'= (X, K', E\ D') 

55 are Vwo encoding schemes with the same message space X. S is said to be equivalent to S' denoted by 5 ^ S\ if 
there is a bijecth^e (one-to-one and onto) mapping h : K-» /Csuch that for each message x G Xand for each key /c g K, 



35 — 
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and 

5 

Clear)y, the scheme equivalence relation ^ is an equivalence relation; that is, it satisfies that, for any encoding schemes 
10 S, S\ S", the following hold: (i) S ^ S; (ii) S = S' implies S' = S; and (iii) S « S* and S' = S" imply S s s*. Thus, 
equivalent encoding schemes fomn an equivalence class in that each scheme in the class provides no more and no 
less functionality than any others in the class. 

[0066] The scheme equivalence relation allows one to characterize encoding schemes in several ways. An encoding 
scheme S is said to be idempotent if ^ S. Many of the encoding schemes are idempotent, including the XOR, 
15 muttipllcatlve, shift, substitution, and affine schemes. If a scheme S is idempotent, then there is no point in using the 
product scheme S^, as it requires an extra key but provides no more functionality. 

[0067] Another characterization on encoding schemes using the scheme equivalence relation ^ is that of commuting 
schemes. Two encoding schemes S and S'are said to commute if S x S'^ S'x S . Trivially, any scheme commutes 
with itself. A not-so-trivia! example is that of the multiplicative scheme M and the shift scheme S. To see that they 
20 commute, i.e., Mx Sx M, one can compare the equations 

Et(^a(x)) = ax+b (mod ri) 

25 and 

^a(^fc{^)) = a>f + ad (mod n); 

30 and find out that the mapping 

hiKgX. Kf^ — > Kj^x Kg 

35 defined by 

h{b, a) = (a, a"^£> (mod />)) 

40 makes the product Sx M isomorphic to the product Mx S. 

[0068] Product schemes of key-determined and commuting encoding schemes enjoy a systematic way of transferring 
the right to decode messages. Let x S2 be the product scheme of two key-detemnined and commuting encoding 
schemes. Suppose that h = {h^, tv^) : /C2 x /Cj -> x is the mapping that makes ^ x Isomorphic to x Sg, 
where /i^ : K2 x K, /C| and /ig : x /C| — > First, observe that the product scheme is also key-determined; the 

45 product key space Kf x ^ is a group with respect to the operation * defined by 

(/fi./f2n^i./f2) = ('fi ^(*2.'fi).M^2.^i)-4)- 

50 This is because 
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[0069] Now, the right to decode the encoded message of x can be transfen-ed from the key holder of k to the key 
holder of another key Ar' in the two-step algorithm shown in Figure 3. First, generate a transfer key t = {h^{fc^,k:^- fr.,), 
h2{f(^,l<^^kyk2) (step 310). Then encode the message with the transfer key t according to y'= (step 312). 
[0070] The correctness of the transference algorithm is verified by the following equality: 

5 

15 ' ' 

where the last entity can be readily decoded using the key k' = {k^M^)- 

[0071] The method is best illustrated with the following example, applying the affine cipher A over Z„. Since A = M 
20 X S , and Mand Sare key-detenmined, commuting schemes, the method described above applies to the affine scheme. 
As seen before, rt is the mapping h{b, a) = (a, ab) that makes Sx M Isomorphic to M x S. Thus, h^{b, a) = a and h2 
(a, b) = ab (mod n). The transfer key f from (a, b) to (a\ b') can be derived as 



= +6') 

Then, to decode y using a second key (a*, b'), first generate a transfer key t= (a'sr^ (mod n)ra'ar^b + d'(mod n ))*(fi, 
t2,) (step 31 0). Then encode the message using the transfer key t according io y = t^y+ 12 (mod n) (step 312). 
[0072] The methods presented herein for transferring the right to decode messages are transitive. This means that 

35 two sequential transfers from Alice to Bob and then from Bob to Carol are equivalent to a direct transfer from Altee to 
Carol. It is important to note that, in each of the example schemes, a transfer key is also a key of the scheme. 
[0073] Accordingly, two transfer keys used in the two sequential transfers can be combined to form a transfer key 
for the direct transfer. Take the affine scheme as an example. Let /r = (a, b), k'= (a', b'), and /f"= fa* b") be the keys 
for Alice, Bob, and Carol, respectively. Then the transfer keys are f = (a'a-^,-a'a'^d+ Jb) from Alfee to Bob, V =(a''a'''^ , - 

40 a'a'-^b'+b') from Bob to Carol, and r = (a^a-^.-a'a^^b^b") from Alfce to Carol. It is straightforward to verify that the 
composition of t and t as 
keys in the affine scheme yields f": 



45 /./' = (/,v,,/;/, +/;> 

= {{aW' )(a'a-' )Aa'a"' ){'a'a-'h + h') + {-aWh' + />")) 

50 

In other words, the composition of sequential transfers of the right to decode messages is memory-less; all the inter- 
mediate transfers will not be reflected in the overall transfer. 

[007^] It should be noted also that, for the schemes X, Af, and S, the transfer key generation step is equivalent to 
55 "decbding" /c* with k. Thus, the computation needed in the transfer is the same as the one used in the decoding-and- 
reencoding method for these schemes. One may think that the new method shows no improvement in this efficiency 
regard, but it has been found that the transfer key is message-independent and hence needs to be computed only 
once. When the number of messages m invoh^ed in the transfer increases, this feature will cut the computation required 
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by the re-encoding method by half. Moreover, the transfer key f does not leak any useful Infomiation on the keys /cand 
k\ and a transfer perfonned according to the methods set forth herein will not reveal the message x. These properties 
make the proposed method appealing when the security of the message x and the decoding keys /rand K is an issue 
during a transfer. 

s [0075] A typical system configuration capable of carrying out the methods described with reference to Figure 3 (and 
described in further detail below) is shown in Figure 4. There are three relevant parties in most proxy encryption ap- 
plications. An Encryptor 41 0, a Grantor ^4 412, and a Grantee B414. As will be recognized, the encryption, decryption, 
and other processing operations perfonned In the invention are facilitated by a processor (41 6, 418, 420) under each 
party's control. Each processor is equipped with memory (422, 424, 426) for data storage and a commu nication interface 

10 (428, 430, 432), capable of sending and receiving messages. 

Proxy Encryption Schemes 

[0076] The rest of the disclosure, directed to more fomnal proxy encryption schemes, rather than encoding schemes, 

15 is organized as follows. First, a generic proxy encryption scheme is described and characterized according to several 
criteria. The several following paragraphs fix set forth notation that vn1l be used throughout the disclosure and recall 
the EIGamal public-key encryption scheme. For the purpose of comparison, this disclosure then lists two existing proxy 
encryption schemes and examines their properties in comparison to the present invention. Details on the two new 
proxy encryption schemes are then introduced, together with their security and performance analysis. Applications of 

20 these new schemes to massive document distribution and file protection are given thereafter. 

[0077] As indicated in the introduction, the goal of proxy encryption Is to delegate the decryption right from one to 
another in secure and efficient ways. For the discussion that follows, it is convenient to define the roles of parties that 
may be invoked in proxy encryption. Two most important roles are those of grantor and grantee. A grantons an original 
key holder of encrypted messages who wants to delegate the decryption right to someone else. A grantee is a key 

25 holder designated to perfonn decryption on behalf of a grantor and thus act as grantor's decryption proxy. In the mo- 
tivating example in the introduction, Alice is the grantor while Bob Is the grantee. Other roles may include an encryptor 
who is an one that originally encrypts messages for the grantor, and a facilitatorYfho may help to perform some message 
processing tasks, such as transforming messages encrypted for the grantor into messages encrypted for the grantee. 
Certainly, it is not necessary that all these roles are played by different parties. For example, a party may play roles of 

30 the grantor and facilitator, as in the Mambo and Okamoto schemes discussed below. 

[0078] With these roles in place, a proxy encryption scheme is just a description of how a grantee, possibly with 
some aid from a facilitator, delegates a grantee the right to decrypt messages originally generated by an encryptor for 
the grantee. A proxy encryption scheme may consist of four generic steps: message encryption, proxy key generation, 
proxy transfomiatlon and message decryption. These steps will be described in further detail below, with reference to 

35 Figure 5. 

1 . Message encryption E: The encryptor generates an encrypted message using grantor's encryption key and 
delivers it to the grantor (step 510). 

2. Proxy generation n: To delegate the decryption right to the grantee, the grantor generates a proxy key ti as a 
40 commitment token that allows the grantee to decrypt the message encrypted for the grantor (step 512). 

3. Proxy transformation n: When necessary, the facilitator performs a proxy transformation n, possibly using the 
proxy key to convert the message encrypted for the grantor to a message encrypted for the grantee (step 514). 

4. Message decryption D: Upon receiving the transformed message and possibly the proxy key jc. the grantee 
decrypts the message (step 51 6). 

45 

[0079] Accordingly, it should be observed that the generic scheme above covers the two straightforward solutions 
to proxy encryption mentioned In the Introduction. The re-encryption scheme is a special case where the grantor (Alice) 
is also the facilitator who actually decrypts the message and then encrypts for the grantee (Bob), and the proxy n can 
be considered as a collection of grantor's decryption key and grantee's encryption key, whteh Is used only by the grantor 
so and not by the grantee. The scheme of passing grantor's decryption key to the grantee Is another special case of the 
generic scheme, where the proxy key is the decryption key and the proxy transformation is the identity transformation. 
[0080] However, not all schemes that can be derived from the generic one above are qualified as proxy encryption 
schemes. Intuitively, a proxy encryption scheme has to satisfy some basic requirements, namely delegation, security, 
transitivity and perfomiance, as described below. 

55 

Delegation. To ensure that, at the end of the message decryption step, the grantee is able to recover the original 
message correctly, the following equation must hold for any message rrr. 



12 



EP1 113 617 A2 



where E{m,e) is an encryption function of message m under encryption key e, D{c,d,n) Is a corresponding decryp- 
tion function of encrypted nnessage c under decryption key d and possibly proxy key n, U {c,7t) is the proxy function 
that converts encrypted message c according to proxy key tc, and e^, ©g. 0(4, and dg are the encryption and de- 
cryption keys of the grantor A and grantee B, respectively. 

In addition to the correctness above, the functionality of delegation should be guaranteed. In one form, this 
means that, after the proxy key is issued and the proxy transformation is completed, the message decryption step 
should require no private information from the grantor, and it should be candied out solely by the grantee. In another 
form, this is equivalent to undeniabllity of the delegation from the grantor; that is, once the proxy key Is created 
arid proxy transformation is performed, the grantor should not be able to deny the delegation, without seeking 
other means such as preventing the grantee from obtaining the proxy key and receiving the transformed message. 
As a consequence of this functionality, the grantor's decryption key can be destroyed with grantee's decryption 
key and possibly the proxy key maintaining the ability to decrypt the message. (This is useful in the file protection 
application later In Section 6.) 

Security. In essence, a proxy encryption scheme is also an encryption scheme at least from the grantee's point of 
view. The introduction of proxy keys and transformations must in no way com-promise security and privacy of the 
encryption. Thus, it should be at least computationally hard for any unauthorized third party to recover the original 
message and decryption keys of the grantor and grantee from publicly available infomnation. Moreover, forging 
valid proxy keys by any untrusted party should be very hard. It must be clear, though, that generating the proxy 
key n requires knowledge of at least the decryption key of the grantor; otherwise the underlying encryption system 
is not secure. 

Transitivity, Naturally, the proxy relationship should be transitive. After the grantor delegates the decryption right, 
the grantee should be able to act as a new grantor to delegate the right further to another grantee, by just following 
the same scheme. Moreover, it should be possible for someone, say the first grantor, to delegate the right directly 
to a new grantee by combining all intermediate proxy keys into one proxy key and composing all consecutive proxy 
transformations into one transfonnation. 

Performance. As the re-encryption scheme is an intuitive, straightforward solution to proxy encryption and it sat- 
isfies the above delegation, security and transitivity requirements, any practically useful proxy encryption scheme 
should have no degradation in computational performance when compared with the re-encryption scheme. 

Proxy encryption schemes may vary according to their application requirements. They can be categorized 
according to many aspects. Obvious ones include whether they are public-key or private-key based, and whether 
their security measures are perfect in the infonmatlon theoretical sense or rely on intractability of some computa- 
tional problems. The following aspects ones are related to the proxy key and transformation. 
Confidentiality, While secrecy of messages and decryption keys has to be enforced, secrecy of proxy keys and 
proxy transformations may not be a mandatory requirement. A scheme is called public if proxy keys it generates 
maybe published without compromising its security and proxy transformations applied in untrusted environments; 
otherwise, the scheme is private. In a private scheme, when a proxy key is transferred from the grantor to the 
facilitator and grantee, care must be taken to protect the proxy key from disclosure. As a result, the proxy trans- 
formation which uses the proxy key must be performed in private as welt. 

CommutaUvity. In terms of messages, the grantee must be unconditionally trusted by the grantor, since proxy 
encryption by definition allows the fonner to decrypt on behalf of the latter. However, the trust model may be 
different for their private information. A proxy encryption scheme is commutative rf the grantor and grantee have 
to trust each other with regard to their private keys; othenwise, it is non-commutative. A commutative example is 
that the proxy key is such created that either one of the grantor and grantee can obtain other's decryption key from 
it. Whenever this is the case, the proxy encryption mechanism may be simplified to a key exchange protocol that 
allows the grantee to use grantor's decryption key to decrypt the encrypted messages directly. 
Generality. In many cases, the grantor wants to restrict the scope of the delegated decryption right. Often intended 
restrictions include that the proxy key may only be used by a designated grantee, that the proxy key may only be 
applicable to a specific message, or that the proxy transformation may only be applied by a specific facilitator. For 
example, when a proxy encryption scheme Is used In some appPicatlons like key escrow, It would be ideal that 
proxy keys are Independent of messages they will apply to. But for occasional delegation such as securely spec- 
i|ying inheritance in someone's will, it may be highly desirable that a proxy key can only be restricted to a designated 
f^arty (e.g., a grandchild), applteable to a specific message (e.g., some portion of the will) and possibly used in the 
proxy transfonnation by a particular party (an attorney). 

Degenerateness. When used In the extreme situation where the grantor and grantee are a same person with a 
same decryption key, a proxy encryption scheme should reduce to a regular encryption scheme, without introducing 
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any complications (such as non-tiivial proxy keys and transfomnations, and the requirement of an extra facilitator). 

[0081] As will be shown below, the Mambo and Okamoto schemes are private and non-commutative. Proxy keys in 
their schemes can be either message-Independent or dependent but are not restricted to designated grantees. The 
5 Blaze and Strauss scheme is just opposite: it is public but commutative, and its proxy keys are message-independent 
but uniquely associated with designated grantees. In comparison, the schemes according to the invention set forth 
herein are public and non-commutative, and their proxy keys are message-dependent and restricted to designated 
grantees. 

10 Proxy Encryption Using the EIGamal Cryptosystem 

[0082] As the proxy encryption schemes discussed below in this disclosure will all be based on discrete logarithms 
In multiplicative groups, a formal setting which is common to all these encryption schemes is hereby adopted. The 
notation used herein recalls the EIGamal encryption scheme. Encryption schemes based on discrete logarithms are 
IS particularly advantageous because of their technical advantages over RSA-type schemes and their natural generali- 
zations to many finite groups such as elHptic curve groups over finite fields. 

[0083] As set forth above, for any natural number a let Z„ = {0,1 n-1} denote the ring of integers modulo n, and 

let Z* = {/77 G Z„ 1 gcdi(m,n) =1} denote the multiplicative group of Z„. Note that, when n is a prime, Z^ = {1 ,...,n-1} . 
For a modulo n and a number a that Is relatively prime to n, let ar^ denote the multiplicative inverse of a modulo n\ that 
20 is, ar'* is the element that satisfies aar'^ = 1 (mod n). 

[0084] An element a of Z* is said to be of order m if the number of its powers modulo n is m. A generator p of Z' , 
if it exists, is an element of^ srder I Z^ I (the size of Z^ ); in this case, Z* is a cyclic group. When /i is a prime, every 
element of Z^ except 1 is a generator of Z^ . 

[0085] Let Z * be a cyclic group with a generator g. The discrete logarithm of an element x to the base g, denoted as 
25 loQg X, is the unique integer a, 0^a</7-1, such that x = 9^(mod n). The discrete logarithm problem is that, given a 
prime p, a generator p of , and an element x e Z* find the integer a, 0 ^ a ^ p-2, such that = x(mod p) . 
[0086] A very closely related problem is the Diffie-Hellman problem: given a prime p, a generator got Z^, and elements 
^^(mod p) and ^(mod p), find ^^^(mod p). The discrete-logarithm problem is at least as hard as the Diffie-Hellman 
problem, because any solution to the former problem can be used to solve the latter problem. 
30 [0087] The EIGamal encryption scheme shown in Figure 6 is a part of a discrete-logarithm based, public-key cryp- 
tosystem proposed by EIGamal for both encryption and digital signature. See T. EIGamal, "A public key cryptosystem 
and a signature scheme based on discrete logarithm," IEEE Trans, on Information Theory, Vol. 31 , pp. 465-472 (1985). 
[0088] Referring now to Figure 6 in detail, the EIGamal scheme is set up (step 610) by establishing two public pa- 
rameters p and g, where p is a prime (typically 512 bits in length), such that p-1 has a large (typically 160 bit) prime 
35 factor q (e.g., p=2cf¥'\) and g is a generator in Z^. A private key for a user is set (step 612) by uniformly choosing a 
random number a e Z^^ . Its related public key is cabulated (step 61 4) as a = p«(mod p). The user publishes a and 
keeps a secret. 

[0089] To encrypt a message mXo be sent to user A with public key a, a random number k e Z^^ is unifomnly chosen 
(step 616), and a pair of numbers (r,s), together representing the encrypted message to be sent to A, is calculated 
40 (step 61 8) as follows: 

r= 5f*(mod p) and s = fmit*(mod p). 
45 [0090] To decrypt the message (r,s). the recipient A recovers the message m (step 620) by calculating 

m - s(f^)"^ (mod p). 

50 [0091] Note that the selection of the public parameters is intended to establish equation sP'*(mod p) = 1 (Format's 
little theorem). These parameters should be authentically known to all users. They can be chosen, say, by some trusted 
authority. Also, the way that private key a is chosen ensures that the inverse ar^ of a modulo p-1 exists and is unique. 
[0092] Unlike the RSA public-key encryption scheme, the EIGamal scheme is non-deterministic, since the encrypted 
message also depends on the random number k. Indeed, it is similar in nature to the Diffie-Hellman key exchange 

S5 protocol; the key established between the sender and receiver for encrypting and decrypting the message m is g^ 
(mod p) from r= g^(mod p) (part of the encrypted message) and a = ^^(mod p) (the public key of A). Nevertheless, the 
security of the EIGamal encryption scheme relies on the intractability of the discrete logarithm problem and the Diffie- 
Hellman problem. To date, practice in seeking optimal algorithms for the discrete logarithm problem has not found any 
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efficient (polynomial-time) solution. It is similar to the situation for the integer factorization problem upon which security 
of the RSA scheme is based. Moreover, it has also been shown that, for some primes p, solving the discrete logarithm 
problem Is at least as hard as solving the factorization problem of a same size. This implies that for those ps, the 
EIGamal scheme is at least as secure as the RSA scheme. 

s [0093] Very recently, several proxy encryption schemes have been proposed. All these schemes follow the generic 
proxy encryption scheme In delegating the decryption right: the encryptor sends an encrypted message to the grantor 
A, who then delegates the decryption right to grantee B by creating the proxy key, and after the proxy transformation 
is completed the grantee B finally decrypts the message. Two representative and known proxy encryption schemes 
are presented below: one from Mambo and Okamoto and the other from Blaze and Strauss, both of whk^h are variations 

10 on the EIGamal scheme. Since they have the same scheme setup as the EIGamal scheme, the setup (see steps 
610-614 of Figure 6 above) is omitted from the presentation. 

[0094] Mambo and Okamoto have proposed three proxy encryption schemes: two are based on the EIGamal scheme 
and the other is based on the RSA scheme. The one shown In Figure 6 and described below is EIGamal-based and 
shares Its basic features with the other two schemes. 
15 [0095] Referring now to Figure 7, given a message m that needs to be sent to a grantor A with public key a, the 
message m is encrypted by uniformly choosing a random number /c G Z (step 71 0) and calculating a pair of numbers 
(r,s) representing the encrypted message (step 712) as follows: 

20 r= (mod p) and s = /7?a*(mod p). 

[0096] To delegate the^ decryption right to a grantee B, the grantor A creates a proxy key n by uniformly choosing a 
random number a' G Z (step 714) and calculating n = aa\^^^od{p-^)) (step 71 6). Then. A delivers the proxy key n 
to S(step 71 8) in a secWe manner (e.g., by encrypting rt with Bs public key) and keeps the value of et private. 
25 [0097] To allow Bto decrypt the message, A calculates 1^= r^'^{mod p), where a"-^ Is the multiplicative inverse of a' 
modulo p-1 (step 720). The pair (/*, s) is the transformed, encrypted message to be sent to B, 

[0098] Upon receiving the transfomried message (/. s) and the proxy key tc, B decrypts the message m (step 722) 
by calculating m = s{r^ y^{mo6 p). 

[0099] This proxy encryption scheme uses the encryption and decryption components of the EIGamal scheme, except 
30 B's private key is replaced by the proxy key n. It is correct because, when using % to decrypt the transformed message 
(/*, s), the following holds: 

s^'-O" (mod p) = s(r^^'^' *)"* (mod p) = mg^{g^)^ (mod p) = m. 

35 

[0100] The security of this scheme is evaluated in two aspects. The complexity for anyone, including the grantee B, 
to discover grantor As private key a based on all the available infomnation is as same as the one for solving the discrete 
logarithm problem. The difficulty for anyone, even with the proxy key, to impersonate A to transform the encrypted 
message (i.e., to generate (;*, s)) is the same as the one for solving the Diffie-Hellman problem. 

40 [0101] This scheme has several very appealing features. First, its security implies that it is hard for B to recover As 
private key. In this sense, there is no need for A to trust B, and hence the scheme Is non-commutative. Second, the 
proxy key n generated is message-independent. 6can use it to decrypt all the messages transfonned by A. Third, this 
scheme satisfies the transitivity requirement. Upon receiving both the proxy key n and the transfomried message (/, 
s), the delegated user Scan further delegate the proxy to another user C, by treating ic as the private key a and (/*, s) 

45 as (r, s) and repeating the proxy generation and transfomiatlon. Fourth, the scheme req uires less computational efforts 
than the re-encryption scheme. 

[0102] However, implementing proxy encryption in the manner of this scheme has several shortcomings. First, the 
proxy key contains no information about the delegated grantee B, it is solely derived from grantor As private key. 
Moreover, the message decryption perfomned by Sdoes not need Bs private decryption key either. Consequently, the 
50 message can be recovered by anyone that gets hold of the proxy key and encrypted message, not necessarily B. Thus, 
Scan ask anyone to decrypt the message by directly passing the proxy information. In many cases, this is not desirable; 
A should be able to specify the key holder who Is to act on As behalf. 

[0103] Second, the proxy key n has to be a secret between A and B and needs to be transmitted from A to 6 in a 
secure manner. As a result of n containing no information of B and (/', s) being possibly communbated in public, 
55 revealing n Is essentially equal to disclosing the message. 

[0104] Third, the proxy transfonnation has to be conducted by A. The value 3t used in the transformation is a secret 
to A and it Is vital to preventing Sfrom knowing A's decryption key a. 

[0105] In short, the scheme is non-commutative and message-independent, but private and unable to specify the 
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designated grantee. 

[0108] Blaze and Strauss have described another public-key proxy encryption scheme. As can be seen in Figure 8. 
the scheme is similar in structure to EIGamal encryption, but with the parameters used differently and the Inverse of 
the secret used to recover the message. 
5 [0107] Turning now to Figure 8 in more detail, given a message m that needs to be sent to a grantor A with public 
key a, the message m Is encrypted by uniformly choosing a random number k G 2^*^ (step 810) and calculating a pair 
of numbers (r, s) representing the encrypted message (step 812) as follows: 

r= m^{mo6 p) and s =a'^(mod p) . 

[0108] To delegate the decryption right to a grantee B, the grantor A creates a proxy key n by obtaining Bs private 
decryption key b (step 814) and computing n = a'^b{motiip-^)) (step 816), where a^^ is the inverse of the private key 
a of i4 modulo p-1 . The proxy key n can be made public. 
IS [01 09] To use the proxy key n to convert a message (r, s) encrypted for AXoa message encrypted for B, the facilitator 
(not necessarily A, since the proxy key n is public) computes s*= si"(mod p)(step 818). The pair {r, s) represents the 
transformed encrypted message, which can then be transmitted to B. 

[01 10] To decrypt the transformed message, B computes m = /ts***"")'"* (mod p) (step 820), where b is Bs private key 
and tri is the inverse of b modulo p-1 . 
20 [0111] The scheme is correct, since in the message decryption 

flr*(mod p) and /n=r(flr*)"^(mod p). 

25 The scheme is secure in that the message m and secret keys a and £>cannot be recovered from the encrypted messages 
and public keys. IVIoreover. publishing the proxy key compromises neither the message m nor the secret keys a and 
b. More precisely, the problem of recovering m from the publk; information (a, p, r, s, n, is as hard as the Diffie- 
Hellman problem. 

[0112] In contrast to the previous scheme, the last security feature makes it unnecessary to keep the proxy key n 
30 private. Thus, the grantor A can publicly send k to whoever (facilitator) is to perform the proxy transformation, or can 
simply publish it. Moreover, the scheme does not require any secret from A in order to carry out the proxy transformation, 
and consequently it allows anyone, trusted or not, to perform the transformation and hence eliminates the necessity 
of >4fe, as well as Bs, presence in the transformation. 

[01 13] Also unlike the previous scheme, there Is no difference to the user B between decrypting a regular encrypted 
35 message and decrypting a proxy transformed message. This elegant feature allows the user B to treat all incoming 
encrypted messages unifomnly. In fact, rt is possible for an untrusted facilitator or server to perform the proxy transfor- 
mation and then forward the message to the user S. 

[01 1 4] in spite of these desirable features, this scheme Is commutative; the involved key holders A and B must trust 
one another bilaterally. Scan learn As secret key a (by multiplying the proxy key by ir''). In addition, the proxy key is 

40 also message-Independent, as it is In the previous scheme, which delegates B the right to decrypt all messages en- 
crypted for As private key a. Accordingly, this scheme is public and message- Independent but commutative. 
[01 15] Two proxy encryption schemes according to the invention are presented herein, and then analyzed In regard 
to their security, commutatMty and perfomnance. Like the private proxy scheme, they are non-commutative, and at the 
same time, they support public proxy keys and transformations in the fashion the commutative proxy scheme does. 

45 However, they differ from the private and commutative schemes in that they are message dependent. Moreover, their 
overall performance is better than the EIGamal-based re-encryption scheme. 

[01 16] Again, these schemes share the same scheme setup of the EIGamal scheme, and they assume that a grantor 
A delegates the decryption right to a grantee S. 

[0117] To understand how to adapt the EIGamal scheme into a proxy encryption scheme, it is helpful to examine 
50 some details of the EIGamal scheme. It should be noted that the r component of the encrypted message m Is inde- 
pendent of the recipient As private key a and public key a. As s = ma^{xx\o6 p) = mg'^^{mod p), a is only used in the s 
component, and a is implicitly embedded in sfe exponent. Thus, it is sufficient for the proxy transformation to convert 
the message encrypted for A into the message encrypted for B by removing As private key a from s and replacing it 
with iBs private key b. In order to prevent B from obtaining As private key a, the function to generate the proxy key 
55 must be somehow "one-way." Indeed, this can be achieved with aid of the random number k as follows: 

n = ^<*»-«> (mod p) . 
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Consequently, the proxy transformation that completes the message conversion should look like the following: 

s' = sjc(mod p) = mg^g^^^^ (mod p = mg^ (mod p). 

5 

[0118] The above discussion leads to the scheme in Figure 9. It tums out that the proxy key and transfomnation 
satisfy the security requirement and provide desired being-public and non-commutativlty features. 
[0119] Referring now to Figure 9, given a message m that needs to be sent to a grantor A with public key a, the 
message m is encrypted by unifomily choosing a random number k G (step 91 0) and cateulating a pair of numbers 
10 (r, 5) representing the encrypted message (step 912) as follows: 

r- p^(mod p) and s = ma'^(mod p). 

15 [0120] To delegate the decryption right to a grantee 0, grantor A creates a proxy key k by obtaining B's authentic 
decryption key b (step 914) and calculating n = (mod p) (step 91 6). 

[0121] The message is transfomned from (r, s) to (r, s) by calculating ^ = s 7c(mod p) (step 91 8). The message w is 
then decrypted by B from (r, s*) by computing m = s1(r*)-^ (mod p) (step 920). 

[0122] Clearly, this scheme uses the message encryption and decryption steps of the EIGamal scheme. It is correct 
20 as the message m can be recovered from 

s'(rV^ (mod p; = sjc {h'\n\o6 p) = mg^g'^^'^^ (/V' (mod p) = m, 

25 [0123] A nice feature of this scheme Is that, not only do regular and proxy encrypted messages appear no different 
to the grantee S, but also the scheme coincides with the EIGamal scheme when A and B are the same user with the 
same key; in this case, the proxy value n Is equal to 1 and the proxy transformation Is the identity transformation. 
[0124] It is easy to see that the scheme is transitive. Upon receiving the proxy transformed message, the grantee B 
can act like the grantor A to further delegate the decryption right to. say, another grantee C by repeating the proxy 

30 generation step with the keys b and c in place of a and b. 

[0125] Also like the commutative scheme, the proxy generation step requires both As and Bs private keys in order 
to generate the proxy key tc. As an alternative, this step can be canled out by anyone that is trusted by both A and B. 
As noted above, A's private key is definitely needed, as othenwise anyone can issue a proxy key to recover the message 
and the underlying encryption scheme is not secure. To establish and communicate Bs private key b, many key- 

35 exchange protocols such as the DIffie-Hellman key exchange may be used. As shown in further detail below, in some 
practrcal applications the requirement of the key b either is not a problem or can be relaxed. 

[0126] But unlike the private and commutative schemes, this scheme does not make it easy for the grantee B to 
decrypt messages encrypted for A other than the Intended one. Clearly, the proxy key n contains a piece of Information 
that Is specific to the encrypted message m, namely, the random number /f. In this sense, the proxy scheme is message- 

40 dependent. Moreover, the scheme is non-commutative In the sense that It Is hard for B to discover A's private key a. 
This fact, together with the performance of the scheme will be established after presenting the next scheme. 
[0127] Note that, In the previous scheme, the proxy transformation only changes the s component of the encrypted 
message. Since s is the part that actually can-ies the infomiation about the message m, the scheme may not be efficient 
when m is a very long message. For example, the proxy key generated would be as long as the message and the effort 

45 spent in the proxy transfomiation would be linear with regard to the length of the entire message. 

[0128] The scheme presented in Figure 10 tends to improve this situation. It uses the message encryption step of 
the commutative scheme In which the message m is shifted from sto r. Its proxy key and transfonnation now have no 
direct dependence on the message m. 

[0129] As shown in Figure 10, given a message m that needs to be sent to a grantor y4 with public key a, the message 
50 m is encrypted by uniformly choosing a random number k G Z^^ (step 1 01 0) and calculating a pair of numbers (r, s) 
representing the encrypted message (step 1012) as follows: 

r= mg'^ (mod p) and s = a* (mod p) . 

55 

[0130] To delegate the decryption right to a grantee B, grantor A creates a proxy key n by obtaining B's authentic 
decryption key b (step 1 01 4) and calculating k = (sa-i)^a (mod p) (step 1 01 6), where a^^ is the Inverse of a modulo p-1 . 
[0131] The message is transfomned from (r, s) to (r, s) by calculating s'= sjc(mod p) (step 1 01 8). The message m is. 
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then decrypted by Sfrom (r, s") by computing m- /(s*'^^ (mod p) (step 1020), where tr"* is the inverse of & modulo p-1 . 
[0132] This scheme is correct since 

5 r{s"* ' )''(mod p) = r((s;r)*'' y\mod p) 

= r({5(5" (mod 

= /-((g"* (mod /7) 
= ^^'5 (g ) (mod/7) 
= m 

Other properties of this scheme can be verified in the same way as the previous scheme. 

15 [01 33] Due to their similarity in nature, only the first of the two new schemes is analyzed in this section in regard to 
its security and non-commutativity. An almost same discussion can be carried out for the second scheme. In addition, 
though the first scheme (as well as the second scheme) is transitive and Its security may Involve more than two key 
holders, the analysis to be given only considers the two-key-holder case; the general case Is also similar. For presen- 
tation clarity, the phrase "(mod p)" will be omitted In this subsection; Its occurrence should be clear from context. 

20 [01 34] Recall that, other than the scheme parameters {p, g), the public infomiation available from the scheme includes 

25 [0135] For the reasons set forth below, the scheme is computationally secure. It is hard to recover the message m 
and secret keys a and b from the public Information, provided that the DIffie-Hellman and discrete- logarithm problems 
are hard to solve. Since the proxy key is part of the public information, this implies publishing it compromises neither 
the message nor the secret keys. A consequence of this is that it is also hard for anyone to forge a valid proxy key in 
a systematic manner. Beyond that, the scheme is shown to be non-commutative In the sense that even with Bs private 

30 key, it is still hard to recover A's private key. If the proxy key is indeed generated by a third party trusted by both >4 and 
B, this fact implies that it is not necessary for Sto trust A either. This is a significant improvement over the commutative 
scheme. 

[01 36] Moreover, as stated above, the proxy encryption schemes of the invention are more efficient than re-encrypting 
a message. Below, in Table 2, is the periormance of the two proxy encryption schemes according to the invention 
35 described herein compared with the re-encryption scheme using the EIGamal algorithm, in terms of the amount of 
computation they require. In Table 2, the numbers of multiplication operations, exponentiation operations, and inver- 
sions, all performed modulo p, are listed for these schemes. 



Table 2 



Operations 


Re- Encryption 


First Scheme (Fig. 9) 


Second Scheme (Fig. 10) 




mult. 


exp. 


inv. 


mult. 


exp. 


Inv. 


mult. 


exp. 


inv. 




Encryption 


1 {x2) 


2(x2) 


0(x2) 




2 


0 


1 


2 


0 


Proxy Key Gen. 










1 


0 


0/1 


2/1 


1/0 


Transformation 








1 


0 


0 


1 


0 


0 


Decryption 


1 (x2) 


1 (X2) 


1 (x2) 


1 


1 


1 


1 


1 


2/1 


Total 


4 


6 


2 


3 


4 


1 


3/4 


5/4 


3/1 



50 

[0137] Note that the total number of operations for re-encryption using the EIGamal scheme Is twice the number of 
operations for a single EIGamal encryption and decryption, since the message must first be encrypted, then decrypted, 
then re-encrypted, then re-decrypted. Moreover, the computation in the second scheme can be optimized by (1) pre- 
comi^utlng the Inverses ar^ and tr ^ In the scheme setup step and (ii) multiplying the two exponential components 
55 (modulo (p-1)) in the proxy generation step instead of using two exponentiations. The second set of numbers under 
the second scheme result from this optimization. Overall, the inventive proxy encryption schemes presented herein 
have better performance than the simple, EIGamal-based re-encryption scheme. 
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Applications 

[0138] Public and non-commutative proxy encryption schemes provide a key mechanism for implementing a wide 
range of applications. Massive document distribution and file protection are two key motivations for this disclosure. 
5 These applications correspond to two typical situations for proxy encryption. The former is related to the case where 
the grantor is the one who encrypts the message at the first place, while the latter is to self-delegation in which the 
grantor and grantee are the same key holder but with different keys. 

[0139] Again, note that a document refers to any digital file whose content could text, graphics, audio, video, exe- 
cutable or even multi-media. Usually, a document is large in size, even after compression. Because public-key algo- 

10 rithms tend to be very slow when compared with conventional private-key algorithms such as DES, IDEA and RC4, 
and private-key algorithms require establishing secret keys to begin with, the most practk^al approach to massive and 
secure distribution of documents over networks is to combine the private-key and public-key encryption mechanisms. 
Typically, an efficient private-key algorithm is used to encrypt the document by using a randomly generated key, called 
the session key, and the public key for each document recipient is used to encrypt this session key. Recipients use 

'5 their private keys to recover the secret session key and then use it to decrypt the document. 

[0140] Indeed, the above document distribution approach has the proxy encryption flavor; the owner encrypts the 
document first using a private-key scheme and then grants the decryption right, upon request, to its recipients via a 
public-key scheme. It turns out that, either one of the two new proxy encryption schemes can be used to combine the 
best features of the approach into a single, normal encryption scheme. 

20 [0141] Take the second scheme set forth above (Figure 1 0), for example. Two observations are in order. First, the 
component rot the encrypted message can be generated using any private-key encryption scheme with K= g*(mod 
p) as the secret session key. Accordingly, the message m can be recovered In the message decryption step by its 
corresponding private-key decryption using the secret session key s*^^ (mod p) = K, In fact, the secret-key en- 
cryption scheme used in the scheme is r = {m) - mK (mod p) for encryption and m = 0^<r) = rK'''^ (mod p) for 

25 decryption. Another simple example is the encryption scheme based on bit-wise XOR (®). In this case, the computation 
of rand m can be replaced by 

r= Ef^ {m) ^ K and Df^{r) = K . 

30 

Certainly, more sophisticated private-key encryption schemes such as OES and triple- DES can be employed if stronger 
security is needed. 

[01 42] The second observation is that, if the grantor A is the one who encrypts the message m, then A can keep the 
random number /r private and use Bs public key p = (mod p) , instead of Bs private key b, to generate the proxy key: 

35 

71 = (pa ^)'' (mod p), 

where a is As public key. This eliminates the requirement for Bs private key b (or key exchange between A and 6), 

40 and implies that B does not have to trust A, either. 

[0143] These two observations lead to the document distribution scheme shown in Figure 1 1 , which is based on the 
second proxy encryption scheme according to the invention set forth above (and in connection with Figure 10). In the 
scheme, a private- key encryption scheme is used to encrypt the message Just once for all recipients, while a less 
expedient proxy-key portion is used to encrypt a small amount of information - the session key - customized once for 

45 each recipient. A benef icial feature of this scheme Is that the encrypted document can be stored in a publicly accessible 
repository, and the proxy transformation can be perfomied by the document owner A, the recipient B, or the repository 
where the document is physically stored, depending upon the needs of real document management and distribution 
systems. 

[0144] Referring now to Figure 11 , the scheme is set up the same way as a standard EIGamal scheme (see Figure 
50 6, described above). In addition, a symmetric, private-key encryption scheme is selected (step 1110). Its encryption 
function is m E;^ (m) and decryption function \sr>~^ ^k(^* where K is some private key. 

[0145] To encrypt a document m, owner A first chooses a uniformly random number k G (step 1112) and cal- 
culates a session key K= ^ (mod p) (step 1114). The encrypted document (r, s) is then calculated as follows: 

55 ' ^ 

r- Ef^{m) and s= fC (mod p) . 
(step 1116), where a is As private key. A keeps the pair (s, A) private. 
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[0146] Upon request from a recipient Sfor the encrypted document (r, s), A first obtains fl's authentic public key p 
(step 1118) and retrieves Ac from the pair (s, k) (step 1120). A then computes 71^= p'fs*''(mod p) (step 1122), where sr^ 
is the inverse of s modulo p, as the proxy key for B, 

[0147] The document is then transformed by computing s'= SK^mo<i p) (step 1124); the pair (r, s') represents the 
transformed document customized for B. 

[0148] To decrypt the customized document {r, s) and retrieve the original document m, Sflrst recovers the session 
key by calculating K= s'^^(mod p) (step 1126), where tr'^ Is the Inverse of b modulo p-1 . Then the document itself Is 
decrypted by calculating m = Df^{t) (step 1 1 28). 

[0149] As described above, an adaptation of the present invention is also applicable to a file protection application. 
Usually, file protection in insecure systems such as laptops and networked hardware Involves long-temri encryption of 
files. Thus, encryption keys used for file encryption have much longer lifetimes than their communication counterparts. 
While a user's primary, long-temri, secret key may be the fundamental representation of a network identity of the user, 
there is a danger that it might get compromised if it is used for many files over a long period of time. If the primary key 
is lost or stolen, not only are contents of the files encrypted with it disclosed, but also the user loses personal information 
based on the key such as credit card account, social security number, and so on. Therefore, it is often preferable to 
use an on-line method In whk^h a new decryption key is derived from the primary key every time a file needs to be 
encrypted and gets updated on a regular basis. 

[0150] With the proxy encryption schemes set forth herein, new decryption keys can be generated and constantly 
updated through self -delegation to keep them fresh. Once a new key is created and a con-esponding proxy key gen- 
erated, the old secret key can be destroyed, with the new key and proxy key maintaining the ability to decrypt the file. 
[0151] Figure 12 shows a file protection scheme that uses a smart card to store and update decryption keys. It is 
again based on the second proxy encryption scheme presented herein, as illustrated in Figure 10. 
[01 52] As shown in Figure 1 2. to encrypt a file m, a processor embedded in a smart card chooses a random number 
k G Z^^ (step 1210) and computes 

r= mg^ (mod p) and s = (p'^)^{mod p) 

(step 1212), where a is the smart card's private key. The pair (c s) represents the file m in encrypted fonm. 
[01 53] Whenever necessary or desired, for example every few weeks or after a predetermined number of document 
accesses, the smart card generates another uniform random number a'G Z ]^ (step 1214) and computes s'= (s^^)«' 
(mod p) (step 1216), where sr^ is the multiplicative inverse of a modulo p-1 . The encrypted file (r, s) is then replaced 
with (r, s) (step 1218), and the decryption key a is replaced with a new decryption key a' (step 1220). These steps 
1214-1220 can be repeated as many times as desired. 

[0154] To recover the original file m from its encrypted version (r, s), the processor on the smart card uses the latest 
decryption key a to compute m = rs«-"' (mod p) (step 1222). 

[0155] Note that the file encryption step can start with any secret key it generates, not necessarily the smart card's 
private key. 

[0156] To keep encrypted files fresh by updating encryption data with a piece of smart-card-generated information 
helps to maintain single useful copies of protected files. This, in some sense, provides copy protection as well. Moreover, 
the non-commutativity of the scheme renders previous copies of the files useless, as the corresponding secret infor- 
mation stored in the smart card has been changed (and preferably destroyed). 

Proxy Encryption Using the Cramer-Shoup Cryptosystem 

[01 57] Although the foregoing examples and algorithms all employ various adaptations of the EIGamal cryptosystem, 
it should be noted that other cryptosystems can also be adapted by a scheme according to the invention. 
[01 58] For example, the Cramer-Shoup pubtte-key cryptosystem is a recently proposed cryptosystem that is the first 
practk:ai public-key system to be provably immune to the adaptive chosen ciphertext attack. See R. Cramer and V. 
Shoup, "A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack," Proceed- 
ings of CRYPTO '98, Springer Veriag LNCS, vol. 1462, pp. 13-25 (1998). The adaptive chosen ciphertext attack as- 
sumes that the attacker can obtain decryptions of any chosen ciphertexts other than the target ciphertext. For example, 
if the target ciphertext for which the plaintext is wanted is c, then the attacker is assumed to have access to a "decryption 
oracle" which will decrypt any ciphertext except c, including for example c+1 , 4c, etc. RSA and EIGamal fall easily to 
this kind of attack. A different, but equivalent, notion of security against active attacks Is called non-malleabliity; however, 
known nonmalleable systems are not practical. 

[0159] Set forth below in Figure 13 is a description of a hash-free version of the Cramer-Shoup cryptosystem, the 
security of which is based strictly on the Diffie-Heilman decision problem for an arbitrary group. Thereafter,. how to 
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delegate the right to decrypt in a Cranner-Shoup scheme will be illustrated in two different situations. 
[0160] Referring initially to Figure 13, the system is set up by choosing G as a group of prime order g, where q is 
large (step 1310). The system assumes that cleartext messages are (or can be encoded as) elements of G, and 
ciphertext messages are elements of G*=Gx GxGx G; that is, a ciphertext message is four times as long as its 

5 corresponding plaintext message. 

[0161] A good example of the group G is the subgroup of order q in the multiplicative set for some large prime p 

= 2q¥\. In this case, a message m from the set {1 q] can be "encoded" by squaring it modulo resulting in an 

element in G, and the message m can be recovered from its encoding by computing the unique square root of its 
encoding modulo p, in the set {1..,.,q}. 

10 [0162] A key is generated as follows. First, random elements e Gare chosen (step 1312), and random elements 
Xi.X2.yii,yi2.y2i.y22.y3i.y32^-? e are chosen (step 1314). Next, the group elements c= = /ii 5^12 = 

5^21 ^22, = SF^31 g^32, and h = g^zl are computed (step 131 6). The public l<ey is then calculated to be (p^g^^c.d,, 
d^.d^A (step 131^8) and the private key is calculated to be (Xi,X2,yii,yi2.y2i.y22»y3i.y32.^ (step 1320). 
[0163] Given a message m G G, the encryption method begins by choosing r G Z^ at random (step 1322). Then the 

'5 ciphertext (t/i,tj^,e,v) is calculated as follows (step 1324): 

r r r r "l"^ "a*" er 

t'l - 9i* ^2- 92^ ^ - ^ v= c di d 3. 

20 [0164] Given the ciphertext (u^,U2»^'^» con-esponding decryption algorithm first tests if v = u*i +i^>^i+u2iei+e>3i 
i/2+oiyi2+ua>22+«>Q2 (step 1326). If not, the decryption effort is rejected (step 1328). Otherwise, the message m is cal- 
cinated as m= e/w^i (step 1330). 

[01 65] The correctness of a cryptosystem can be verified by checking that the decryption of an encryption of a mes- 
sage yields the message. In this case, since = p( and t/2 = g^, one has t/^i ^^=0^. Likewise, 

25 

t/2 = c di 02 d3 and t/^= n . 

Therefore, for the valid ciphertext, the test perfomned in the decryption algorithm will pass. 
30 [0166] The security of this cryptosystem relies upon the difficulty in solving the Dlffie-IHellman decision problem. An 
algorithm that solves the Diffie-Hellman decision problem is a statistical test that can effectively distinguish the following 
two distributions: (a) random quadruples {g^,g^,u^xi^^ Q*. and (b) random quadruples {g^.g^My.^ii^ G*. where g^, 
g^ are random and ^ g!j and t/g = p| for some random r G 

[0167] Related to the Diffie-Hellman decision problem are the Diffie-Hellman problem (given g, g^, and gy, compute 
35 pxy), and the discrete logarithm problem (given g and g^, compute x). Within polynomial time, the Diffie-Hellman decision 
problem can be reduced to the Diffie-Hellman problem which in turn can be reduced to the discrete logarithm problem. 
It is this relationship between the three problems that leads to the possibility of delegating the right to decrypt for the 
Cramer-Shoup system. 

[0168] Assume that someone wants to delegate the right to decrypt from a delegator (Alice, A) to a delegatee (Bob. 

40 6). Suppose that Alice has the public key (g^,g2,c,d^,d2,d^,h) and the private key (Xi,>^,yii,y^2'y2i'y22'y3i«y32»^' 
that Bob has the public key (firi,fl'2»^'^i'^2'<^3'^) private key {^^»^2y^^y\2y2vyz2yz2*^)' 

[0169] Recall, that for a given plaintext message m G G, the ciphertext message for delegator ^ Is M= (u^ ,U2»e, v),- 
where Ui = , tJfe = = • ^^o^^i' Similarly, if the message m Is directly encrypted for the delegatee 

B, the ciphertext message is M = (i/^.t/a.e^V). where t/^ = g^- "'2 = ^2'. e'= and v' = c'^c/*'V'd"'2'^'d«v' ^here 

45 f is also a random number from Z^. Note further that v = {c<P^ ^(^2!^^^ ^nf\ v'= (c'd*''id*'^2c/^y, 

[01 70] Based on the ideas set forth above, to delegate the right to decrypt from >4 to B involves generating a transfer 
key 7c, using that transfer key to transfomi M into Af . In the following, it is assumed that the components g\ ,g^ of Bs 
public key are identical to the components of As public key (analogously to the ElGamal system parameters 
described above). Also, it is assumed that the random number / is the same as r. Under these two assumptions, 

50 elements u\ , of Bs ciphertext message are the same as elements u^ .t/g of As ciphertext message. 

[0171] Referring now to Figure 1 4, the system is set up by choosing G as a group of prime order g, where q is large 
(step 1410). Then, as above, key is generated as.follows. First, random elements p^d^ ^ ^ chosen (step 1412), 
and random elements >fi,J^,yii.yi2.y2i'y^'y3i»y32'^ ^ Z^j are chosen (step 1414). Next, the group elements c= d^^^^* 
= P^^^ d2 = p*'2i ^22^ = ^^^Sf^f and Aj = fi^ are computed (step 1416). The public key is then calculated 

55 to be{g^,g2fc,d^ .d^.ctj,)?) (sfep 1 41 8) and the private key is calculated to be (x, ,X2,yii,yi2»y2i .y22.y3i»y32«^ (step 1 420). 
[0172] Given a message m G G, the encryption method begins by choosing r e Z^ at random (step 1422). Then the 
ciphertext (Ui,iJ^,e,v) Is calculated as follows (step 1424): 
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= 9i, 92 , e= h m, and y = cd^ . 

[0173] If Bs private key is available for generating the transfer i<ey n, that I^ey is obtained (step 1426) and then n 
s can be calculated (step 1 428) as follows: 

71 = (8.0,5^.52.53) 

10 where 

d ~ C f C = gg = Ug 

5,=c/Vd5=ii;'^^"''^^up^"''^^ 

5i = 03 / = i/^ U2 
The ciphertext transfonnation is then 

2Q u\ = i/^, c/2 = i/g, = and v'= vGS^ 5 253. 

This transforms the ciphertext (u^.u^.e.v) Into (t/^.t/g.e'.v) (step 1430). 

[0174] The recipient/del egatee Is then able to decrypt the transfonned cyphertext (t/i,Li2»e». As above, the decryp- 
tion algorithm first tests if ✓= *''i>''ii^"2J' 21+ «V'3i u'^V"2y'i2+«|'2>''22+«V'32(step1432). If not, the decryption effort 
35 is rejected (step 1434). Otherwise, the message m is calculated asm - e'/u^' (step 1436). 

[0175] In the case where only the public key of the delegatee 8 can be used for delegating the right to decrypt the 
message from the delegator A to S, one needs to save and use the random number r used initially in encrypting the 
message for A. This may be a problem where the party to generate the transfer key is not A and may not be a problem 
if the party is, in fact, A. In any case, if it is available, the transfer key ic can be generated using Bs public key as follows: 
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ic = (e.e.61, 52,53) 

where 
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The proxy transformation Is then 

5 

u\ = u^, u*2 - ^2. e' = e8, and v'= veS^ 6 3^3 • 

[0176] It is straightfonvard to verify, in either case, that the delegatee B can use his own private key to decrypt the 
10 ciphertext (u\ .Ug.e', v) transformed by the methods set forth above. Since the mechanisms used herein on the Cramer- 
Shoup cryptosystem are the same as those used above on EIGamal-lllce cryptosystems, they are public and non- 
commutative, assuming the Diffie-Hellman problem and the discrete logarithm problem are difficult to solve. 
[0177] As described above, through enhancing common public-key encryption schemes with the proxy encryption 
capability, it becomes possible to support flexible designated decryption. This disclosure has presented two public and 
15 non-commutative proxy encryption schemes, which have inherited the merits of the existing schemes and discarded 
their shortcomings. The new schemes have been shown to have direct applications to massive document distribution 
and file protection. The bask: idea of these new schemes has also been applied to cryptosystems of other types such 
as the Cramer-Shoup cryptosystem, enhancing them into proxy encryption schemes. 

[0178] While the various aspects of the present invention have been described with reference to several aspects 
20 and their embodiments, those embodiments are offered by way of example, not by way of limitation. The foregoing 
detailed description of the invention has been presented for purposes of illustration and description. It is not intended 
to be exhaustive or to limit the Invention to the precise f omn disclosed, and obviously many modifications and variations 
are possible In light of the above teaching. The described embodiments were chosen in order to best explain the 
principles of the invention and its practical applications to thereby enable others skilled in the art to best utilize the 
25 invention in various embodiments and with various modifications as are suited to the particular use contemplated. 
Those skilled in the art will be enabled by this disclosure will be enabled by this disclosure to make various obvious 
additions or modifications to the embodiments described herein; those additions and modifications are deemed to lie 
within the scope of the present invention. It is intended that the scope of the invention be defined by the claims appended 
hereto. 

30 

Claims 

1. A public, non-commutative method for encoding an original message to be passed to a recipient by way of an 
35 grantor, the method comprising the steps of: 

obtaining an encrypted message representative of the original message, the encrypted message having been 
encrypted with a publk: key corresponding to the grantor; 

generating a publk; proxy key based on a private key corresponding to the recipient, wherein it is computa- 
40 tionalty diffteult to recover the private key corresponding to the recipient from the public proxy key; and 

applying the public proxy key to transform the encrypted message into a transformed message, wherein the 
transformed message is decryptable by the recipient using information selected from the private key corre- 
sponding to the recipient and any available public infomriation. 

^5 2. The method of daim 1 , wherein the encrypted message has been encrypted with an EIGamal encryption scheme. 

3. The method of claim 1 , wherein the encrypted message has been encrypted with a modified EIGamal encryption 

scheme. 

50 4. The method of claim 1 , wherein the receiving, generating, and applying steps are performed by the grantor 

5. A public, non-commutative method for encrypting an original message to be passed to a recipient by way of an 
grantor, the method comprising the steps of: 

55 obtaining an encrypted message representative of the original message, the encrypted message having been 

encrypted with a public key corresponding to the grantor; and 

transforming the encrypted message, using a transfomiation key corresponding to the recipient, into a trans- 
formed message, wherein the transformed message is decryptable by the recipient using information selected 
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from a private key corresponding to the recipient and any available public Information. 

6. The method of claim 5, wherein the transfbmiation key comprises a private key corresponding to the recipient. 

s 7. The method of claim 5. wherein the transfomnation key comprises a public key corresponding to the recipient. 

8. The method of claim 5, wherein the encrypted message has been encrypted with a Cramer-Shoup encryption 
scheme. 

10 9. The method of claim 5 wherein the transfomned message Is decryptable by the recipient using a private key cor- 
responding to the recipient. 

10. The method of claim 5, wherein the original message is passed to a recipient through at least one additional 
intermediate grantor by repeating the transforming step for each additional intermediate grantor. 
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